CVE-2026-42097: Authentication Bypass in Sparx Pro Cloud Server
Sparx Pro Cloud Server requires authentication based on requested URL. An attacker can omit the "model" query parameter and send the model name only in the binary blob in POST request allowing SQL query execution without authentication.
The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.1 (build 167) and below were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42097?
CVE-2026-42097 has a critical severity rating of 9.3.
What type of vulnerability is CVE-2026-42097?
CVE-2026-42097 is classified as an authentication bypass vulnerability.
How can an attacker exploit CVE-2026-42097?
An attacker can exploit CVE-2026-42097 by omitting the 'model' query parameter in a POST request, allowing SQL query execution without authentication.
What is the impact of CVE-2026-42097?
The impact of CVE-2026-42097 includes unauthorized execution of SQL queries, which can lead to data leaks or corruption.
How do I fix CVE-2026-42097?
To fix CVE-2026-42097, implement proper validation mechanisms for query parameters and ensure authentication is required for all POST requests.